HDPA (Greece) - 15/2026
Greece's DPA fines Ministry and Company €350K over data breach affecting 2.5M subjects.
Run HDPA?
Get an email when a reviewed story names HDPA, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Greece's Data Protection Authority (HDPA) has fined the Ministry of Social Cohesion and Family €200,000 and the Hellenic Local Development and Local Government Company €150,000 following a large-scale data breach. The breach, which affected approximately 2.5 million individuals, occurred due to outdated information systems and inadequate security measures at the processor's end. The DPA emphasized that public interest and lack of resources do not exempt organizations from their GDPR security obligations.
The lesson from this incident
Full lessonThe breach affecting approximately 2.5 million individuals stemmed from outdated information systems and inadequate security controls at the data processor's end, highlighting the critical importance of maintaining up-to-date infrastructure regardless of organizational type. The HDPA's decision to fine both the controller (Ministry of Social Cohesion and Family) and the processor underscores that GDPR accountability flows through the entire data processing chain. Public-sector organizations cannot rely on resource constraints or public interest mandates as defenses against GDPR security obligations. This case demonstrates that failure to enforce security standards on third-party processors carries significant financial and reputational consequences for the data controller as well.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.